IDM-SAP CUA Integration

Question

I have been under the impression that instead of creating accounts on each SAP child systems (SAP ECC, SAP Portal, SAP BI etc), we can create the accounts in SAP CUA using IdM and then provide information to SAP CUA such that it does further provisoining on SAP child systems
Is this possible ?
     So, far I have not been able to create such account. I am successful in creating accounts in SAP CUA, however, no matter which attribute I use (cuasystems, activityGroups etc) to represent a list of SAP child systems to be passed to SAP CUA to create account, it does not work.
I am definitely out of ideas and looking for some help.
Thanks,
Rajesh

Answer 1

I think there is a setting on the SAP CUA system and the child systems that needs to be set correctly.
We have an environment where we provision a user to CUA and assign the user roles (direct activity groups) that map to BI and ECC.
CUA then uses those roles and the systems they map to in order to provision to those child systems.
Check your SAP configuration, because this worked fine for us. One thing to note, is that changing an existing user's password in CUA will NOT replicate to child systems. So you may have to manage those child systems directly to change passwords.